Validation errors

A submission whose fields do not comply with the form definition receives a 422, in Laravel's standard format:

{
    "message": "The email field must be a valid email address. (and 1 more error)",
    "errors": {
        "email": ["The email field must be a valid email address."],
        "message": ["The message field must be at least 20 characters."]
    }
}

errors is an object whose keys are the field names, and whose values are lists of messages. A field can carry several.

Displaying errors

In attached mode, the script places the message under the relevant field and passes the full object in the rikochey:error event:

form.addEventListener('rikochey:error', (event) => {
    event.preventDefault();          // I handle the display myself
    console.log(event.detail.errors); // { email: ['…'] }
});

Message language

Messages — standard ones and the custom messages set by the client — are in the language the form was rendered in, among the languages the form offers:

1. form_locale, sent by the script, when the form offers it;
2. failing that, the page language (page_locale) — or, when it is missing or not a supported language, the website language set by the client in their panel — reduced to its base language (en-GB → en) when needed, and kept only if the form offers it;
3. failing that, the form's source language.

The visitor's browser language is never used: a form rendered in French on a French page answers in French, even if the visitor arrives with an English browser. See Languages.

A required consent field that is not checked gets the standard "must be accepted" message, in that same language.

Rules come from the form

Almost no validation is fixed: each field carries the rules the client composed in their panel — length, format, value, comparison between fields, conditional requirement. The up-to-date definition is in window.FORMS[].fields[].

The one exception is a maximum length, applied to every field that does not already carry one, because the payload comes from the public:

Numbers and dates have none — a max there bounds the value, not the length. A minimum length the client set above one of these ceilings raises it. Exceeding the ceiling is a plain 422 on that field.

Two behaviors worth knowing:

• a field hidden by a display condition is neither validated nor recorded, even if it is marked as required;
• an undeclared field that you send anyway is not validated, but it is kept with the request and visible to the client.

Server-side validation is authoritative

The script applies the same rules in the browser to display errors immediately, but the server-side check has the final say. A forged request that bypasses the script is validated in exactly the same way.